Hi @IQ78 ,

You can send something like this in Teams: For dynamic token generation, create a separate GetAccessToken API. This API will generate the access token using the client credentials, save the token in the database along with its expiry date/time, and return the existing token if it's still valid. Before each REST API call, check the token expiry; if expired, generate a new token and update the DB. Then use the token in the Authorization: Bearer {token} header for subsequent API calls. 

Hi @IQ78 ,

Yes, you can create a Bearer token dynamically. We implemented a similar approach in one of our projects.

Our implementation works like this:

1. We created a separate Generate Token API.
2. The consumer system calls this API using an API Key and API Secret.
3. After validating the credentials, we generate a JWT Bearer Token.
4. The generated token is stored in the database along with its expiry time (in our case, 30 minutes).
5. The consumer system then uses this token when calling the actual API, for example:

Authorization: Bearer 

6. On the target API, we validate:
   • API Key
   • Bearer Token
   • Token expiry
   • JWT validity/signature

If all validations pass, the request is processed; otherwise, the API returns an unauthorized/failed response.

So the overall flow is:

1. Consumer System   
      API Key + API Secret
2.Generate Token API 
     Generate JWT 
3.Bearer Token (30 min expiry) 
      Authorization: Bearer   
4.Protected API  
     Validate Token + API Key   
5.Pass Success / Failure

This approach worked well for us when we needed dynamic, short-lived authentication tokens between systems.

Regards
Deepa

Hi @IQ78 ,

You can follow the official OutSystems guide here:

Token-based authentication for exposed REST APIs - OutSystems 11 Documentation